WO2006067471A1

WO2006067471A1 - Apparatus and method for enabling network connection

Info

Publication number: WO2006067471A1
Application number: PCT/GB2005/005016
Authority: WO
Inventors: Alexander Ogilvie; Alexander John Haddow; Fraser Renny Ingram
Original assignee: Airlie Connections Limited
Priority date: 2004-12-21
Filing date: 2005-12-21
Publication date: 2006-06-29

Abstract

An easy-to-use network authentication scheme has USB tokens or keys and a network controller having several USB sockets. The network controller is for example a secure wireless broadband modem/router that acts as a firewall and ADSL modem, using WEP or WPA. A USB token is plugged into a PC, where it configures the PC’s network settings and gathers network information from the PC. The token is then plugged into one of the controller’s sockets where it configures the controller to allow network access for the PC previously configured by the token. The network access may be disallowed immediately upon removal of the token, or on expiration of a timer. The user can therefore avoid software setup of the secure wireless network.

Description

Apparatus and method for enabling network connection

The present invention relates to an apparatus and a method for authenticating network connections , and in particular to a controller adapted to authenticate network connections on connection of a token to the controller .

In the field of computer networks , configuration of the network components is required to enable network connections and to provide secure authentication of the connections .

The configuration of a computer network can however be complicated and often requires the skills of experienced people . For example to set up a PC (personal computer) network requires knowledge of a great many technologies and acronyms . For example IP address , DMZ , encryption, server, sub-address , firewall , domain, USB, TCP/IP, SSL, DHCP, modem, CAT5 cabling, MAC address , filter, ISA, WEP, Hub and network adaptor . To network specialists these are common technologies and terms but to many business or home users they are confusing and troublesome terms . For example in the set up of a wireless home network, in the best case the software configuration comes with a "standard options" dialogue, but if not then the user will be required to be knowledgeable on DHCP (Dynamic Host Configuration Protocol ) , IP ( Internet Protocol) addresses , masks and much more . If the ^ΛXstandard options" are enabled then they will allow PCs and the hub to detect each other and prompt the user for actions such as entering the PC name and a network domain name . Problems can arise with wireless networks where a second network is operational in proximity to a first . In these circumstances , the user of the first network has to distinguish between the detected hardware from the first and second networks .

Despite requiring the user to input information on the screen of the PC, users may be able to share resources that access the internet relatively quickly. However the network is likely to be insecure and vulnerable to attack, especially if the default settings have been chosen as the various components were installed .

In making the network secure, the user ' s next problem is the setup of the firewall . Due to the nature of wireless technology it is essential that firewalls be configured correctly or unrestricted access by unknown third parties can be granted unwittingly. Firewalls typically allow the user to set them up such that only specific PCs can gain access to the internet and indeed each other . A secure way to configure a firewall in this way is to use the MAC (media access control) address relating to each network adaptor . This MAC address has to be obtained from the adapter ' s associated PC and entered into the firewall configuration for each network adaptor in use .

After setting up the firewall to restrict unauthorised connection to the network it is important to also secure the wireless traffic that is transmitted from one network node to the other with respect to eavesdropping . This is another problem for a novice user . This requires setting up the security aspect of the wireless network and means allocating a WEP (Wireless Encryption Protocol) or WPA (Wi-fi Protected Access) key or password. A WEP or WPA key is an encryption key and it is entered by the user on each PC which is wirelessly connected. It ensures that third parties can not easily eavesdrop on traffic and gain priority information . The WEP or WPA configuration is however normally buried deep within a network system dialogue box.

In summary, the problems are that the setup of the firewall and WEP or WPA keys are complicated processes that require skill and understanding of the user . Consequently, many users do not implement these powerful and secure features of the network even though they purchase it with the capabilities embedded within the hardware and software provided.

USB tokens are known in the prior art to be used for authentication of users in a network. Typically the token contains a cryptographic chip for securely storing a user ' s personal identity information, such as passwords or digital certificates . It is an obj ect of the present invention to provide an improved authentication of network connections .

According to a first aspect of the present invention there is provided a controller for network authentication comprising: a network interface ; an authentication module comprising authentication settings , wherein the authentication module is adapted to control the network interface to authenticate network connections to network nodes using the authentication settings ; and a token interface adapted to connect to a token, thereby updating the authentication settings .

Preferably, the authentication module comprises a firewall .

Preferably, the authentication settings comprise network node identification information .

Preferably, the token interface is adapted to receive network node identification information from the at least one token and to update the authentication settings with the received network node identification information .

Preferably, the token interface is adapted to connect to the token via a USB (Universal Serial Bus ) connection .

Preferably, the token interface is adapted to update the authentication settings on detection of disconnection of a token from the token interface . Preferably, the token interface is adapted to update the authentication settings upon a further condition.

Preferably, the further condition is the expiration of a timer .

Alternatively, the further condition is a manual intervention .

According to a second aspect of the present invention there is provided a token for network authentication comprising : a controller interface adapted to connect to a network authentication controller, thereby updating the network authentication controller ' s authentication settings ; and a node interface adapted to connect to a network node and extract network node identification information from the network node .

Preferably, the controller interface is adapted to connect to the network authentication controller via a USB connection .

Preferably, the controller interface is adapted to update the network authentication controller authentication settings by transferring network node identification information to the network authentication controller .

Preferably, the network node identification information comprises a media access control address .

Preferably, the network node identification information comprises an encryption key. Preferably, the encryption key is a WEP key .

Optionally the encryption key is a WPA key .

Preferably, the node interface is further adapted to configure the network node for connection to a network authentication controller .

Preferably, the node interface is adapted to configure the network node by transferring an encryption key to the network node .

Preferably, the node interface is adapted to configure the network node by transferring network authentication controller identification information to the network node .

Preferably, the token further comprises a storage module adapted to store the network node identification information.

Preferably, the storage module is further adapted to store the network authentication controller identification information .

Preferably, the token further comprises an encryption key generation module .

Preferably, the token further comprises a user input module adapted to initiate the operation of the token .

Preferably, the user input module is a button . Preferably, the user input module further comprises a user authentication module .

Preferably, the token further comprises an indicator module adapted to indicate the completion of the operation of the token .

According to a third aspect of the present invention there is provided an apparatus comprising a controller and at least one token, wherein the controller authenticates network connections to network nodes by connection to the at least one token .

Preferably, the controller is a controller according to the first aspect .

Preferably, the token is a token according to the second aspect .

According to a fourth aspect of the present invention there is provided a method of authenticating network connections including the steps : connecting a token to a network node; extracting network node identification information from the network node and storing the information in the token; connecting the token to a controller; updating the controller ' s authentication settings using the network node identification information from the token; and the controller authenticating network connections to network nodes using its authentication settings . Preferably, the method further includes a step, while the token is connected to the network node, of configuring the network node for connection to a network authentication controller.

Preferably, the network node is configured with network authentication controller identification information .

Preferably, the network node is configured with an encryption key.

Preferably, the method further includes generating the encryption key and storing the encryption key in the token .

Preferably, the operation of the token is initiated by user input .

Preferably, the method further includes indicating that an operation of the token is complete .

Preferably, the method further includes disconnecting the token from the network node .

Preferably, the method further includes automatically updating the controller authentication settings on disconnection of a token from the controller, so as to disable authentication of network connections to a network node . Preferably, the method further includes automatically updating the controller authentication settings upon a further condition.

Preferably, the further condition is the expiration of a timer .

Alternatively, the further condition is a manual intervention.

Preferably, the network node identification information comprises a MAC address .

Preferably, the network node identification information comprises an encryption key .

The present invention will be described by example only, with reference to the accompanying figures in which:

Figure 1 illustrates in schematic form network apparatus in accordance with an embodiment of the present invention;

Figure 2 illustrates in schematic form an network authentication controller in accordance with an embodiment of the present invention;

Figure 3 illustrates in schematic form a network authentication token in accordance with an embodiment of the present invention; and Figure 4 illustrates a flow chart of the steps of network node authentication in accordance with an embodiment of the present invention .

With reference to Figure 1 , a wireless network with a broadband internet connection is shown in accordance with an embodiment of the present invention .

A PC 1 has an attached wireless network adaptor 2. This is shown as a separate device attached to the PC, but alternatively a plug in card may be used. The network node made up of the PC and wireless network adaptor has a network connection to the controller 3. The controller is a secure wireless hub that acts as the firewall and ADSL (Asymmetric Digital Subscriber Line) modem. The ADSL modem is connected to the internet via a telecommunications switch 4. The controller has several USB sockets 5. Each USB socket can receive a token or key which permits network access for the PC previously configured by the token . The token has a USB plug 7 for plugging in to the PC ' s USB socket 8 and subsequently into one of the controller ' s sockets . A series of colour coded labels are provided for attaching to the token and the PC that the token has configured . This aids in identifying which token has been associated with which PC ' s network connection. The controller authenticates the network connection of the PC through the controller to other PC ' s on the network (not shown) or other networks devices (not shown) such as a streaming audio player or network storage device, as well as to the internet using the broadband connection . With reference to figure 2 , a controller 21 is shown . The controller provides network authentication. The network interface 22 provides a wireless network connection 23 a wired internet connection 24 and a wired ADSL connection 25. An authentication module 26 has stored authentication settings 27. The settings include identification information about network nodes, in particular MAC addresses of network adaptors in the network nodes and WEP keys . In this embodiment, the WEP encryption standard is used, although other embodiments may use other standards or methods , such as WPA. The authentication module controls the network interface so as to authenticate network connections to network nodes using the authentication settings . The controller also has a token interface 28 for receiving the connection of tokens through the USB slots 5. When a token is connected to the token interface, network node identification information including a MAC address and a WEP key is transferred into the controller and used to update the authentication settings . The authentication module acts as a firewall . The token interface or some other part of the controller detects the disconnection of a token and automatically updates the authentication settings so as to disable a network connection through the controller from the PC that has previously been configured by and is now associated with the token . In an alternative embodiment , the disconnection of a token does not automatically cause the token interface or controller to update the authentication settings so as to disable a network connection . Instead, when the token is removed from the token interface, the token interface or controller does not disable the network connection until after a timer expires or an administrator manually disables the connection. This allows a user to have a token configured by their IT department , briefly insert and remove their token at a Wi-fi hot spot, such as a cafe, and have temporary access to the network, without having to remember to collect their token . This has the advantage of only requiring the user to have one interaction with the controller, at the beginning of their network access session .

With reference to Figure 3 , a token for network authentication is shown. The token 31 has a controller interface 32 for connecting to one of the controllers USB sockets 5 by connection of the tokens USB plug to a socket . The controller interface updates the controller ' s authentication settings by transferring network node identification information to the controller . This information includes the MAC address of the network node to be authenticated and the WEP encryption key generated by the token . MAC information is stored in a storage that is flash memory 34. The storage also stores information about the identity of the controller including its network address . The token also has a network node interface 35 that connects through the USB plug to a USB socket on the PC 8. The node interface, on connection to the PC, configures the PC ' s settings for connection to the controller . This includes transferring the controller ' s network address to the PC and transferring a generated WEP encryption key to the PC . The node interface also extracts node identification information from the PC, in particular including the MAC address of the PC ' s network adapter. The token also includes an encryption module 36 for generating WEP encryption keys . The interfaces and modules of the token are implemented using a standard single chip microcontroller powered by the USB interface . The token also includes a button 37 for the user to start the operation of the token when it is plugged into the PC or the controller . An indicator LED 38 shows the user that the operation of the token is complete . A user authentication module 39 authenticates users . This can be achieved with a biometric sensor and stored biometric information or, for example, a password that can be accessed and configured using the PC with the token connected to it . Thus the use of the key can be restricted to certain authorised users .

In this embodiment, the token is a USB device which when instructed to do so, by pressing its start button, is able to configure the PC ' s network settings and to extract information about a PC ' s wireless adaptor . In particular, the token extracts and stores the MAC address in its memory and generates a unique WEP key for the configuration of the network settings within the PC . Once it has completed its task it turns on a green light to indicate that it is complete .

By inserting the token into the controller and pressing the start button the user is once again activating the token . This time the token and controller co-operate to update the firewall and network settings within the controller with the details about the PC that it was last activated in .

The process is repeated with separate tokens for each PC in the network . When a user is finished he has a token in the controller for each PC which will remain there as long as the network setup for that PC is desired. In the alternative embodiment, the token may be removed and the network setup for the associated PC persists until a timer expires or some other condition occurs , such as a manual intervention by an administrator .

In this embodiment, should the user ever want to disable a PC ' s network connection, all the user has to do is to remove the appropriate token from the controller . This will trigger the firewall to be updated. During the set up each item (PC, network adaptor and token) has a colour coded sticker applied to it . This ensures that a particular PC can be simply identified and removed from the network with no complex administration software required.

Not only can an inexperienced user set up a network, they can also manage it . At home this is important were a parent may wish to restrict access in rooms at certain times and is equally important in the office were simple administration is a requirement . The token may be programmed to change access privileges using a software Application running on a PC with a token connected to it .

The controller of this embodiment has five sockets to receive tokens but this number can be extended significantly with an extension device carrying a further ten sockets connected via USB to the controller , with further extensions being added in a daisy chain .

With reference to Figure 4 a detailed flowchart of one example of the authentication method is shown . The user connects 41 a token to the PC and presses 42 the start button . The token extracts 43 the MAC address of the network adaptor from the PC and stores it in the token . The token generates 44 a WEP encryption key and stores it in the token ' s memory. The token then configures 45 the PC network settings for connection to the controller by providing the PC with the controller network address and the generated WEP encryption key. The token then activates 46 the LED to indicate that its operation is complete and the user disconnects 47 the token from the PC . The user carries the token to the controller and connects 48 the token by plugging it into a USB socket . The user again presses 49 the start button which causes the token to update 50 the controller' s authentication settings by transferring the MAC address from the PC and the generated encryption key from the token' s memory into the controller . The token then activates 51 the LED to indicate that its operation is complete . With the token connected, the controller begins to authenticate 52 network connections using the authentication settings . In particular it allows network traffic and network connections between network nodes , other network nodes , and the internet for the particular network node configured by and associated with the token . This continues until the user disconnects 53 the token from the controller which causes the controller to automatically update 54 its authentication settings so as to disable the authentication of the network node configured by and identified with the disconnected token . Thereafter the controller performs authentication 55 for network connections but does not allow connection or traffic to or from the network node configured by and associated with the disconnected token . In the alternative embodiment , the controller begins to authenticate 52 network traffic , but continues after the disconnection 53 of the token until a further condition is met , for example the expiration of a timer, the manual intervention of an administrator, or the authenticated network node going out of range of the wireless network connection .

In a further embodiment, the authentication may cease irrespective of when the token is removed, for example after a timer expires .

In a further embodiment tokens are provided associated with network nodes that the user has no direct access to, for example a special token can be pre-programmed with network node information relating to internet access so that the controller will not activate its internet connection via the ADSL modem unless the particular token is plugged into the controller . In another embodiment a master token can be used to activate all network connections or disable the operation of MAC authentication of all the network nodes .

The present invention provides several advantages to end users . These include ease of installation, a no-jargon approach using an easy to understand metaphor, simple network administration capability, a secure network infrastructure , secure wireless communications and an easy to scale solution appropriate for home or office use . An advantage for the retailer and manufacturer is that limited support is required compared to solutions which involve user configuration via software interfaces . Further modifications and improvements may be added without departing from the scope of the invention herein described.

Claims

1. A controller for network authentication comprising : a network interface ; an authentication module comprising authentication settings , wherein the authentication module is adapted to control the network interface to authenticate network connections to network nodes using the authentication settings ; and a token interface adapted to connect to a token, thereby updating the authentication settings .

2. The controller of claim 1 , wherein the authentication module comprises a firewall .

3. The controller of any previous claim, wherein the authentication settings comprise network node identification information .

4. The controller of any previous claim, wherein the token interface is adapted to receive network node identification information from the at least one token and to update the authentication settings with the received network node identification information .

5. The controller of any previous claim, wherein the token interface is adapted to connect to the token via a USB (Universal Serial Bus ) connection .

6. The controller of any previous claim, wherein the token interface is adapted to update the authentication settings on detection of disconnection of a token from the token interface .

7. The controller of any previous claim, wherein the token interface is adapted to update the authentication settings upon a further condition.

8. The controller of claim 7 , wherein the further condition is the expiration of a timer.

9. The controller of claim 7 , wherein the further condition is a manual intervention .

10. A token for network authentication comprising : a controller interface adapted to connect to a network authentication controller, thereby updating the network authentication controller ' s authentication settings ; and a node interface adapted to connect to a network node and extract network node identification information from the network node .

11. The token of claim 10 , wherein the controller interface is adapted to connect to the network authentication controller via a USB connection .

12. The token of any of claims 10 to 11, wherein the controller interface is adapted to update the network authentication controller authentication settings by transferring network node identification information to the network authentication controller .

13. The token of any of claims 10 to 12 , wherein the network node identification information comprises a media access control address .

14. The token of any of claims 10 to 13 , wherein the network node identification information comprises an encryption key.

15. The token of any of claims 10 to 14 , wherein the encryption key is a WEP key.

16. The token of any of claims 10 to 14 , wherein the encryption key is a WPA key.

17. The token of any of claims 10 to 16 , wherein the node interface is further adapted to configure the network node for connection to a network authentication controller .

18. The token of any of claims 10 to 17 , wherein the node interface is adapted to configure the network node by transferring an encryption key to the network node .

19. The token of any of claims 10 to 18 , wherein the node interface is adapted to configure the network node by transferring network authentication controller identification information to the network node .

20. The token of any of claims 10 to 19 , further comprising a storage module adapted to store the network node identification information .

21. The token of claim 20 , wherein the storage module is further adapted to store the network authentication controller identification information .

22. The token of any of claims 10 to 21 , further comprising an encryption key generation module .

23. The token of any of claims 10 to 22 , further comprising a user input module adapted to initiate the operation of the token .

24. The token of claim 23 , wherein the user input module is a button .

25. The token of any of claims 23 to 24 , wherein the user input module further comprises a user authentication module .

26. The token of any of claims 10 to 25 , further comprising an indicator module adapted to indicate the completion of the operation of the token .

27. An apparatus comprising a controller and at least one token, wherein the controller authenticates network connections to network nodes by connection to the at least one token .

28. The apparatus of claim 27 , wherein the controller is a controller according to claims 1 to 9.

29. The apparatus of any of claims 27 to 28 , wherein the token is a token according to the claims 10 to 26.

30. A method of authenticating network connections including the steps : connecting a token to a network node; extracting network node identification information from the network node and storing the information in the token; connecting the token to a controller; updating the controller ' s authentication settings using the network node identification information from the token; and the controller authenticating network connections to network nodes using its authentication settings .

31. The method of claim 30 , further including a step, while the token is connected to the network node, of configuring the network node for connection to a network authentication controller .

32. The method of any of claims 30 to 31 , wherein the network node is configured with network authentication controller identification information.

33. The method of any of claims 30 to 32 , wherein the network node is configured with an encryption key.

34. The method of any of claims 30 to 33 , wherein the method further includes generating the encryption key and storing the encryption key in the token .

35. The method of any of claims 30 to 34 , wherein the operation of the token is initiated by user input .

36. The method of any of claims 30 to 35 , further including indicating that an operation of the token is complete .

37. The method of any of claims 30 to 36 , further including disconnecting the token from the network node .

38. The method of any of claims 30 to 37 , further including automatically updating the controller authentication settings on disconnection of a token from the controller, so as to disable authentication of network connections to a network node .

39. The method of any of claims 30 to 38 , further including automatically updating the controller authentication settings upon a further condition .

40. The method of claim 39 , wherein the further condition is the expiration of a timer .

41. The method of claim 39 , wherein the further condition is a manual intervention.

42. The method of any of claims 30 to 41 , wherein the network node identification information comprises a MAC address .

43. The method of any of claims 30 to 42 , wherein the network node identification information comprises an encryption key.